The remote Oracle Linux 5 / 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2011-2033 advisory.

    - ipv6: make fragment identifications less predictable (Joe Jin) {CVE-2011-2699}
    - vlan: fix panic when handling priority tagged frames (Joe Jin) {CVE-2011-3593}
    - ipv6: udp: fix the wrong headroom check (Maxim Uvarov) {CVE-2011-4326}
    - b43: allocate receive buffers big enough for max frame len + offset (Maxim Uvarov) {CVE-2011-3359}
    - fuse: check size of FUSE_NOTIFY_INVAL_ENTRY message (Maxim Uvarov) {CVE-2011-3353}
    - cifs: fix possible memory corruption in CIFSFindNext (Maxim Uvarov) {CVE-2011-3191}
    - crypto: md5 - Add export support (Maxim Uvarov) {CVE-2011-2699}
    - fs/partitions/efi.c: corrupted GUID partition tables can cause kernel oops (Maxim Uvarov)     {CVE-2011-1577}
    - net: Compute protocol sequence numbers and fragment IDs using MD5. (Maxim Uvarov) {CVE-2011-3188}
    - crypto: Move md5_transform to lib/md5.c (Maxim Uvarov) {CVE-2011-3188}
    - perf tools: do not look at ./config for configuration (Maxim Uvarov) {CVE-2011-2905}
    - Make TASKSTATS require root access (Maxim Uvarov) {CVE-2011-2494}
    - TPM: Zero buffer after copying to userspace (Maxim Uvarov) {CVE-2011-1162}
    - TPM: Call tpm_transmit with correct size (Maxim Uvarov){CVE-2011-1161}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2012:0010 advisory.

    The kernel-rt packages contain the Linux kernel, the core of any Linux     operating system.

    This update fixes the following security issues:

    * A malicious CIFS (Common Internet File System) server could send a     specially-crafted response to a directory read request that would result in     a denial of service or privilege escalation on a system that has a CIFS     share mounted. (CVE-2011-3191, Important)

    * The way fragmented IPv6 UDP datagrams over the bridge with UDP     Fragmentation Offload (UFO) functionality on were handled could allow a     remote attacker to cause a denial of service. (CVE-2011-4326, Important)

    * GRO (Generic Receive Offload) fields could be left in an inconsistent     state. An attacker on the local network could use this flaw to cause a     denial of service. GRO is enabled by default in all network drivers that     support it. (CVE-2011-2723, Moderate)

    * IPv4 and IPv6 protocol sequence number and fragment ID generation could     allow a man-in-the-middle attacker to inject packets and possibly hijack     connections. Protocol sequence numbers and fragment IDs are now more     random. (CVE-2011-3188, Moderate)

    * A flaw in the FUSE (Filesystem in Userspace) implementation could allow     a local user in the fuse group who has access to mount a FUSE file system     to cause a denial of service. (CVE-2011-3353, Moderate)

    * A flaw in the b43 driver. If a system had an active wireless interface     that uses the b43 driver, an attacker able to send a specially-crafted     frame to that interface could cause a denial of service. (CVE-2011-3359,     Moderate)

    * A flaw in the way CIFS shares with DFS referrals at their root were     handled could allow an attacker on the local network, who is able to deploy     a malicious CIFS server, to create a CIFS network share that, when mounted,     would cause the client system to crash. (CVE-2011-3363, Moderate)

    * A flaw in the m_stop() implementation could allow a local, unprivileged     user to trigger a denial of service. (CVE-2011-3637, Moderate)

    * Flaws in ghash_update() and ghash_final() could allow a local,     unprivileged user to cause a denial of service. (CVE-2011-4081, Moderate)

    * A flaw in the key management facility could allow a local, unprivileged     user to cause a denial of service via the keyctl utility. (CVE-2011-4110,     Moderate)

    * A flaw in the Journaling Block Device (JBD) could allow a local attacker     to crash the system by mounting a specially-crafted ext3 or ext4 disk.
    (CVE-2011-4132, Moderate)

    * A flaw in the way memory containing security-related data was handled in     tpm_read() could allow a local, unprivileged user to read the results of a     previously run TPM command. (CVE-2011-1162, Low)

    * I/O statistics from the taskstats subsystem could be read without any     restrictions, which could allow a local, unprivileged user to gather     confidential information, such as the length of a password used in a     process. (CVE-2011-2494, Low)

    * Flaws in tpacket_rcv() and packet_recvmsg() could allow a local,     unprivileged user to leak information to user-space. (CVE-2011-2898, Low)

    Red Hat would like to thank Darren Lavender for reporting CVE-2011-3191;
    Brent Meshier for reporting CVE-2011-2723; Dan Kaminsky for reporting     CVE-2011-3188; Yogesh Sharma for reporting CVE-2011-3363; Nick Bowler for     reporting CVE-2011-4081; Peter Huewe for reporting CVE-2011-1162; and     Vasiliy Kulikov of Openwall for reporting CVE-2011-2494.

    This update also fixes the following bugs:

    * Previously, a mismatch in the build-id of the kernel-rt and the one in     the related debuginfo package caused failures in SystemTap and perf.
    (BZ#768413)

    * IBM x3650m3 systems were not able to boot the MRG Realtime kernel because     they require a pmcraid driver that was not available. The pmcraid driver is     included in this update. (BZ#753992)

    Users should upgrade to these updated packages, which correct these issues.
    The system must be rebooted for this update to take effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote VMware ESX / ESXi host is missing a security-related patch.
It is, therefore, affected by multiple vulnerabilities, including remote code execution vulnerabilities, in the following components :

  - Kernel
  - krb5 telnet daemon

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Integer signedness error in the CIFSFindNext function in fs/cifs/cifssmb.c in the Linux kernel before 3.1     allows remote CIFS servers to cause a denial of service (memory corruption) or possibly have unspecified     other impact via a large length value in a response to a read request for a directory. (CVE-2011-3191)

Note that Nessus relies on the presence of the package as reported by the vendor.

Dan Rosenberg discovered that the IPv4 diagnostic routines did not correctly validate certain requests. A local attacker could exploit this to consume CPU resources, leading to a denial of service.
(CVE-2011-2213)

Dan Rosenberg discovered that the Bluetooth stack incorrectly handled certain L2CAP requests. If a system was using Bluetooth, a remote attacker could send specially crafted traffic to crash the system or gain root privileges. (CVE-2011-2497)

It was discovered that the EXT4 filesystem contained multiple off-by-one flaws. A local attacker could exploit this to crash the system, leading to a denial of service. (CVE-2011-2695)

Mauro Carvalho Chehab discovered that the si4713 radio driver did not correctly check the length of memory copies. If this hardware was available, a local attacker could exploit this to crash the system or gain root privileges. (CVE-2011-2700)

Herbert Xu discovered that certain fields were incorrectly handled when Generic Receive Offload (CVE-2011-2723)

Time Warns discovered that long symlinks were incorrectly handled on Be filesystems. A local attacker could exploit this with a malformed Be filesystem and crash the system, leading to a denial of service.
(CVE-2011-2928)

Dan Kaminsky discovered that the kernel incorrectly handled random sequence number generation. An attacker could use this flaw to possibly predict sequence numbers and inject packets. (CVE-2011-3188)

Darren Lavender discovered that the CIFS client incorrectly handled certain large values. A remote attacker with a malicious server could exploit this to crash the system or possibly execute arbitrary code as the root user. (CVE-2011-3191).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This Linux kernel update fixes various security issues and bugs in the SUSE Linux Enterprise 10 SP4 kernel.

The following security issues have been fixed :

  - A USB string descriptor overflow in the auerwald USB     driver was fixed, which could be used by physically     proximate attackers to cause a kernel crash.
    (CVE-2009-4067)

  - Always check the path in CIFS mounts to avoid     interesting filesystem path interaction issues and     potential crashes. (CVE-2011-3363)

  - A malicious CIFS server could cause a integer overflow     on the local machine on directory index operations, in     turn causing memory corruption. (CVE-2011-3191)

  - The is_gpt_valid function in fs/partitions/efi.c in the     Linux kernel did not check the size of an Extensible     Firmware Interface (EFI) GUID Partition Table (GPT)     entry, which allowed physically proximate attackers to     cause a denial of service (heap-based buffer overflow     and OOPS) or obtain sensitive information from kernel     heap memory by connecting a crafted GPT storage device,     a different vulnerability than CVE-2011-1577.
    (CVE-2011-1776)

The following non-security issues have been fixed :

  - md: fix deadlock in md/raid1 and md/raid10 when handling     a read error. (bnc#628343)

  - md: fix possible raid1/raid10 deadlock on read error     during resync. (bnc#628343)

  - Add timeo parameter to /proc/mounts for nfs filesystems.
    (bnc#616256)

  - virtio: indirect ring entries     (VIRTIO_RING_F_INDIRECT_DESC). (bnc#713876)

  - virtio: teach virtio_has_feature() about transport     features. (bnc#713876)

  - nf_nat: do not add NAT extension for confirmed     conntracks. (bnc#709213)

  - 8250: Oxford Semiconductor Devices. (bnc#717126)

  - 8250_pci: Add support for the Digi/IBM PCIe 2-port     Adapter. (bnc#717126)

  - 8250: Fix capabilities when changing the port type.
    (bnc#717126)

  - 8250: Add EEH support. (bnc#717126)

  - xfs: fix memory reclaim recursion deadlock on locked     inode buffer. (bnc#699355 / bnc#699354 / bnc#721830)

  - ipmi: do not grab locks in run-to-completion mode.
    (bnc#717421)

  - cifs: add fallback in is_path_accessible for old     servers. (bnc#718028)

  - cciss: do not attempt to read from a write-only     register. (bnc#683101)

  - s390: kernel: System hang if hangcheck timer expires     (bnc#712009,LTC#74157).

  - s390: kernel: NSS creation with initrd fails     (bnc#712009,LTC#74207).

  - s390: kernel: remove code to handle topology interrupts     (bnc#712009,LTC#74440).

  - xen: Added 1083-kbdfront-absolute-coordinates.patch.
    (bnc#717585)

  - acpi: Use a spinlock instead of mutex to guard gbl_lock     access. (bnc#707439)

  - Allow balance_dirty_pages to help other filesystems.
    (bnc#709369)

  - nfs: fix congestion control. (bnc#709369)

  - NFS: Separate metadata and page cache revalidation     mechanisms. (bnc#709369)

  - jbd: Fix oops in journal_remove_journal_head().
    (bnc#694315)

  - xen/blkfront: avoid NULL de-reference in CDROM ioctl     handling. (bnc#701355)

  - xen/x86: replace order-based range checking of M2P table     by linear one.

  - xen/x86: use dynamically adjusted upper bound for     contiguous regions. (bnc#635880)

  - Fix type in     patches.fixes/libiscsi-dont-run-scsi-eh-if-iscsi-task-is
    -making-progress.

  - s390: cio: Add timeouts for internal IO     (bnc#701550,LTC#72691).

  - s390: kernel: first time swap use results in heavy     swapping (bnc#701550,LTC#73132).

  - s390: qeth: wrong number of output queues for     HiperSockets (bnc#701550,LTC#73814).

The kernel packages contain the Linux kernel, the core of any Linux operating system.

This update fixes the following security issues :

  - IPv6 fragment identification value generation could     allow a remote attacker to disrupt a target system's     networking, preventing legitimate users from accessing     its services. (CVE-2011-2699, Important)

  - A signedness issue was found in the Linux kernel's CIFS     (Common Internet File System) implementation. A     malicious CIFS server could send a specially crafted     response to a directory read request that would result     in a denial of service or privilege escalation on a     system that has a CIFS share mounted. (CVE-2011-3191,     Important)

  - A flaw was found in the way the Linux kernel handled     fragmented IPv6 UDP datagrams over the bridge with UDP     Fragmentation Offload (UFO) functionality on. A remote     attacker could use this flaw to cause a denial of     service. (CVE-2011-4326, Important)

  - The way IPv4 and IPv6 protocol sequence numbers and     fragment IDs were generated could allow a     man-in-the-middle attacker to inject packets and     possibly hijack connections. Protocol sequence numbers     and fragment IDs are now more random. (CVE-2011-3188,     Moderate)

  - A buffer overflow flaw was found in the Linux kernel's     FUSE (Filesystem in Userspace) implementation. A local     user in the fuse group who has access to mount a FUSE     file system could use this flaw to cause a denial of     service. (CVE-2011-3353, Moderate)

  - A flaw was found in the b43 driver in the Linux kernel.
    If a system had an active wireless interface that uses     the b43 driver, an attacker able to send a specially     crafted frame to that interface could cause a denial of     service. (CVE-2011-3359, Moderate)

  - A flaw was found in the way CIFS shares with DFS     referrals at their root were handled. An attacker on the     local network who is able to deploy a malicious CIFS     server could create a CIFS network share that, when     mounted, would cause the client system to crash.
    (CVE-2011-3363, Moderate)

  - A flaw was found in the way the Linux kernel handled     VLAN 0 frames with the priority tag set. When using     certain network drivers, an attacker on the local     network could use this flaw to cause a denial of     service. (CVE-2011-3593, Moderate)

  - A flaw in the way memory containing security-related     data was handled in tpm_read() could allow a local,     unprivileged user to read the results of a previously     run TPM command. (CVE-2011-1162, Low)

  - A heap overflow flaw was found in the Linux kernel's EFI     GUID Partition Table (GPT) implementation. A local     attacker could use this flaw to cause a denial of     service by mounting a disk that contains specially     crafted partition tables. (CVE-2011-1577, Low)

  - The I/O statistics from the taskstats subsystem could be     read without any restrictions. A local, unprivileged     user could use this flaw to gather confidential     information, such as the length of a password used in a     process. (CVE-2011-2494, Low)

  - It was found that the perf tool, a part of the Linux     kernel's Performance Events implementation, could load     its configuration file from the current working     directory. If a local user with access to the perf tool     were tricked into running perf in a directory that     contains a specially crafted configuration file, it     could cause perf to overwrite arbitrary files and     directories accessible to that user. (CVE-2011-2905,     Low)

This update also fixes various bugs.

The openSUSE 11.3 kernel was updated to fix various bugs and security issues.

Following security issues have been fixed: CVE-2011-1833: Added a kernel option to ensure ecryptfs is mounting only on paths belonging to the current ui, which would have allowed local attackers to potentially gain privileges via symlink attacks.

CVE-2011-3363: Always check the path in CIFS mounts to avoid interesting filesystem path interaction issues and potential crashes.

CVE-2011-2918: In the perf framework software event overflows could deadlock or delete an uninitialized timer.

CVE-2011-3353: In the fuse filesystem, FUSE_NOTIFY_INVAL_ENTRY did not check the length of the write so the message processing could overrun and result in a BUG_ON() in fuse_copy_fill(). This flaw could be used by local users able to mount FUSE filesystems to crash the system.

CVE-2011-3191: A signedness issue in CIFS could possibly have lead to to memory corruption, if a malicious server could send crafted replies to the host.

CVE-2011-1776: The is_gpt_valid function in fs/partitions/efi.c in the Linux kernel did not check the size of an Extensible Firmware Interface (EFI) GUID Partition Table (GPT) entry, which allowed physically proximate attackers to cause a denial of service (heap-based buffer overflow and OOPS) or obtain sensitive information from kernel heap memory by connecting a crafted GPT storage device, a different vulnerability than CVE-2011-1577.

Following non security bugs were fixed :

  - drm/radeon/kms: Fix I2C mask definitions (bnc#712023).

  - ext4: Fix max file size and logical block counting of     extent format file (bnc#706374).

  - TTY: pty, fix pty counting (bnc#711203).

  - Update Xen patches to 2.6.34.10.

  - xen/blkfront: fix data size for xenbus_gather in     connect().

  - xen/xenbus: fix xenbus_transaction_start() hang caused     by double xenbus_transaction_end().

  - xen/blkback: don't fail empty barrier requests.

  - xen/blktap: fix locking (bnc#685276).

  - xen/xenbus: don't BUG() on user mode induced conditions     (bnc#696107).

  - xen/blkfront: avoid NULL de-reference in CDROM ioctl     handling (bnc#701355).

  - intr-remap: allow disabling source id checking     (bnc#710352).

The openSUSE 11.4 kernel was updated to 2.6.37.6 fixing lots of bugs and security issues.

Following security issues have been fixed: CVE-2011-1833: Added a kernel option to ensure ecryptfs is mounting only on paths belonging to the current ui, which would have allowed local attackers to potentially gain privileges via symlink attacks.

CVE-2011-2695: Multiple off-by-one errors in the ext4 subsystem in the Linux kernel allowed local users to cause a denial of service (BUG_ON and system crash) by accessing a sparse file in extent format with a write operation involving a block number corresponding to the largest possible 32-bit unsigned integer.

CVE-2011-3363: Always check the path in CIFS mounts to avoid interesting filesystem path interaction issues and potential crashes.

CVE-2011-2918: In the perf framework software event overflows could deadlock or delete an uninitialized timer.

CVE-2011-3353: In the fuse filesystem, FUSE_NOTIFY_INVAL_ENTRY did not check the length of the write so the message processing could overrun and result in a BUG_ON() in fuse_copy_fill(). This flaw could be used by local users able to mount FUSE filesystems to crash the system.

CVE-2011-2183: Fixed a race between ksmd and other memory management code, which could result in a NULL ptr dereference and kernel crash.

CVE-2011-3191: A signedness issue in CIFS could possibly have lead to to memory corruption, if a malicious server could send crafted replies to the host.

CVE-2011-1776: The is_gpt_valid function in fs/partitions/efi.c in the Linux kernel did not check the size of an Extensible Firmware Interface (EFI) GUID Partition Table (GPT) entry, which allowed physically proximate attackers to cause a denial of service (heap-based buffer overflow and OOPS) or obtain sensitive information from kernel heap memory by connecting a crafted GPT storage device, a different vulnerability than CVE-2011-1577.

Following non-security bugs were fixed :

  - novfs: Unable to change password in the Novell Client     for Linux (bnc#713229).

  - novfs: last modification time not reliable (bnc#642896).

  - novfs: unlink directory after unmap (bnc#649625).

  - fs: novfs: Fix exit handlers on local_unlink     (bnc#649625).

  - novfs: 'Unable to save Login Script' appears when trying     to save a user login script (bnc#638985).

  - fs: novfs: Limit check for datacopy between user and     kernel space.

  - novfs: Fix checking of login id (bnc#626119).

  - novfs: Set the sticky bit for the novfs mountpoint     (bnc#686412).

  - ACPICA: Fix issues/fault with automatic 'serialized'     method support (bnc#678097).

  - drm/radeon/kms: Fix I2C mask definitions (bnc#712023).

  - ext4: Fix max file size and logical block counting of     extent format file (bnc#706374).

  - novfs: fix off-by-one allocation error (bnc#669378     bnc#719710).

  - novfs: fix some kmalloc/kfree issues (bnc#669378     bnc#719710).

  - novfs: fix some DirCache locking issues (bnc#669378     bnc#719710).

  - memsw: remove noswapaccount kernel parameter     (bnc#719450).

  - Provide memory controller swap extension. Keep the     feature disabled by default. Use swapaccount=1 kernel     boot parameter for enabling it.

  - Config cleanups: CONFIG_OLPC should be enabled only for     i386 non PAE

  - TTY: pty, fix pty counting (bnc#711203).

  - USB: OHCI: fix another regression for NVIDIA controllers     (bnc#682204).

  - xen/blkfront: avoid NULL de-reference in CDROM ioctl     handling.

  - x86, mtrr: lock stop machine during MTRR rendezvous     sequence (bnc#672008).

The remote MiracleLinux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2012-228:02 advisory.

    The kernel package contains the Linux kernel (vmlinuz), the core of any Linux operating system.  The     kernel handles the basic functions of the operating system:  memory allocation, process allocation, device     input and output, etc.
    Security issues fixed with this release:
    CVE-2011-1020     The proc filesystem implementation in the Linux kernel 2.6.37 and earlier does not restrict access to the     /proc directory tree of a process after this process performs an exec of a setuid program, which allows     local users to obtain sensitive information or cause a denial of service via open, lseek, read, and write     system calls.
    CVE-2011-3347     CVE-2011-3638     No information available at the time of writing, see the CVE link below.
    CVE-2011-4110     The user_update function in security/keys/user_defined.c in the Linux kernel 2.6 allows local users to     cause a denial of service (NULL pointer dereference and kernel oops) via vectors related to a user-defined     key and updating a negative key into a fully instantiated key.
    CVE-2011-1162     The tpm_read function in the Linux kernel 2.6 does not properly clear memory, which might allow local     users to read the results of the previous TPM command.
    CVE-2011-1577     Heap-based buffer overflow in the is_gpt_valid function in fs/partitions/efi.c in the Linux kernel 2.6.38     and earlier allows physically proximate attackers to cause a denial of service (OOPS) or possibly have     unspecified other impact via a crafted size of the EFI GUID partition-table header on removable media.
    CVE-2012-0056     The mem_write function in Linux kernel 2.6.39 and other versions, when ASLR is disabled, does not properly     check permissions when writing to /proc/<pid>/mem, which allows local users to gain privileges by     modifying process memory, as demonstrated by Mempodipper.
    CVE-2011-2494     CVE-2011-2699     CVE-2011-2905     CVE-2011-3188     CVE-2011-3191     CVE-2011-3353     CVE-2011-3359     CVE-2011-3363     CVE-2011-3593     CVE-2011-4326     CVE-2011-4127     No information available at the time of writing, please refer to the CVE links     below.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
68424	Oracle Linux 5 / 6 : Unbreakable Enterprise kernel (ELSA-2011-2033)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2026/2/9	critical
76635	RHEL 6 : kernel-rt (RHSA-2012:0010)	Nessus	Red Hat Local Security Checks	2014/7/22	2025/3/24	critical
89107	VMware ESX / ESXi Multiple Vulnerabilities (VMSA-2012-0006) (remote check)	Nessus	Misc.	2016/3/3	2021/1/6	critical
217523	Linux Distros Unpatched Vulnerability : CVE-2011-3191	Nessus	Misc.	2025/3/3	2026/1/28	high
56645	Ubuntu 11.04 : linux vulnerabilities (USN-1246-1)	Nessus	Ubuntu Local Security Checks	2011/10/26	2019/9/19	critical
59160	SuSE 10 Security Update : Linux kernel (ZYPP Patch Number 7811)	Nessus	SuSE Local Security Checks	2012/5/17	2021/1/19	critical
61179	Scientific Linux Security Update : kernel on SL6.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	2012/8/1	2021/1/14	critical
75556	openSUSE Security Update : kernel (openSUSE-SU-2011:1221-1)	Nessus	SuSE Local Security Checks	2014/6/13	2021/1/14	critical
75881	openSUSE Security Update : kernel (openSUSE-SU-2011:1222-1)	Nessus	SuSE Local Security Checks	2014/6/13	2021/1/14	critical
284039	MiracleLinux 4 : kernel-2.6.32-220.4.1.el6 (AXSA:2012-228:02)	Nessus	Miracle Linux Local Security Checks	2026/1/14	2026/2/12	critical

检测

插件搜索

critical

critical

critical

high

critical

critical

critical

critical

critical

critical